All projects

Kernel Fuzzing · OSIRIS Lab · 2026

RaceFuzz: Semantic Kernel Fuzzer

RaceFuzz is the OSIRIS Lab research project I lead: a semantic fuzzing framework that hunts race conditions in the Linux kernel's network stack — the class of bug coverage-guided fuzzers are structurally worst at finding.

  • Go
  • C
  • Linux Kernel
  • TCP/IP
  • Race Conditions
  • Fuzzing
  • OSIRIS Lab

Approach

A race condition is a property of an interleaving, not an input. The same syscall sequence may or may not trigger the bug depending on how the scheduler interleaves two CPUs. RaceFuzz attacks this with structured corpus generation that respects the socket lifecycle state machine, and concurrency-aware scheduling that pins candidate sequences to separate CPUs and deliberately perturbs their overlap to widen race windows.

The network stack is the target because it is remotely reachable, deeply concurrent (softirqs, timers, and user threads all share socket state), and has a rich state machine that semantic generation can exploit.

Highlights

  • Go-based corpus generator that understands socket lifecycle semantics
  • Concurrency analysis and race-window widening instead of pure coverage feedback
  • Interleaving capture for deterministic reproduction of found races
  • Mentored as one of 9 active OSIRIS Lab research projects

Artefacts